Security
Reporting vulnerabilities in Falcon File Transfer and falconfft.com
We take the security of Falcon File Transfer (“fft”) and our users’ data seriously. If you believe you’ve found a security vulnerability, please tell us privately so we can fix it before it’s exploited.
How to report
Email security@falconfft.com. Please include:
- the affected product and version (the output of
fft --version), or the URL; - steps to reproduce, and a proof of concept if you have one;
- what an attacker could do with it;
- how to reach you, and whether you’d like to be credited.
If you need to send sensitive details encrypted, say so in your first email and we’ll arrange it. Our contact details are also published at /.well-known/security.txt.
What we commit to
- Acknowledge your report within 3 business days.
- Give you an initial assessment within 10 business days, and keep you updated until it’s resolved.
- Fix confirmed vulnerabilities as quickly as their severity requires, and tell you when a fix ships.
- Credit you in the release notes if you’d like.
We don’t currently run a paid bug bounty.
Scope
In scope: the current release of the fft command-line tool and desktop app, falconfft.com, and the optional relay service Makai operates for fft.
Out of scope:
- denial-of-service or volumetric testing;
- social engineering, phishing, or physical attacks;
- services we use but don’t run (for example Google or Cloudflare); report those to the provider;
- automated scanner output, or missing best-practice settings, without a demonstrated security impact.
Testing rules
- Test only against your own installations and data, and never access, change or delete data that isn’t yours. If you come across someone else’s data, stop and tell us.
- Don’t degrade the website or the relay service for other users.
- Keep the vulnerability and any information you learn about fft confidential until we’ve released a fix, or 90 days after your report, whichever comes first, unless we agree otherwise. When you publish, limit it to what’s needed to describe the vulnerability.
Safe harbor
If you make a good-faith effort to follow this policy, we consider your research authorized. We won’t take legal action against you or ask law enforcement to investigate, including under our End User License Agreement, for activity limited to finding, demonstrating and reporting a vulnerability. If a third party takes action against you for research that followed this policy, we’ll make it known that your work was authorized.
← Back to falconfft.com